Fix a segfault in mod_include which was found by Sander Striker using

an APR_POOL_DEBUG/ElectricFence build.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@92914 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index d2b19625544b993e8108a9b1d8e8cf773736dcbe..41ea43cb0d48e8b3c68a2a1a68e6ac02bc862f49 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,7 @@
 Changes with Apache 2.0.31-dev
 
+  *) Fix a segfault in mod_include.  [Justin Erenkrantz, Jeff Trawick]
+
   *) Cause Win32 to capture all child-worker process errors in
      Apache to the main server error log, until the child can
      open its own error logs.  [William Rowe]

diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c
index 559ea38933bf41675e1e9e5da19bd2233a1f6232..0d966d0f6b2bd24b85ff81bddafa8d5436481a42 100644 (file)
--- a/modules/filters/mod_include.c
+++ b/modules/filters/mod_include.c
@@ -3063,7 +3063,8 @@ static apr_status_t send_parsed_content(apr_bucket_brigade **bb,
     }
 
     /* We have nothing more to send, stop now. */
-    if (APR_BUCKET_IS_EOS(dptr)) {
+    if (dptr != APR_BRIGADE_SENTINEL(*bb) &&
+        APR_BUCKET_IS_EOS(dptr)) {
         /* We might have something saved that we never completed, but send
          * down unparsed.  This allows for <!-- at the end of files to be
          * sent correctly. */